cyberstrikeus 5.10 Ensure Security Configurations are Reviewed Regularly
Description
Regularly updating and reviewing the security configuration of your Amazon Keyspaces environment helps ensure that your database is protected against potential vulnerabilities and aligned with your security requirements.
Rationale
N/A
Impact
If you are not updating these regularly, your database would most likely become susceptible to a vulnerable attack. Not updating your IAM permission, network, and encryption setting, and controlling audit logging, would lead to the attacker getting into the system which would result in data loss.
Audit Procedure
Using AWS Console
Sign in to the AWS Management Console
- Sign in to the AWS Management Console at https://console.aws.amazon.com/ with your AWS account credentials.
Open the Amazon Keyspaces Console
- Navigate to the service using the
Find Servicessearch bar or by directly accessing the console at https://console.aws.amazon.com/keyspaces/.
- Navigate to the service using the
Select the Keyspace
- Choose the Keyspace (database) for which you want to update and review the security configuration.
- Click on the Keyspace name to access its details page.
Review IAM Roles and Permissions
- In the Keyspace details page, click on the
Configurationtab. - Under the
Authentication and access controlsection, review the IAM roles and permissions associated with the Keyspace. - Ensure that the IAM roles have appropriate permissions and follow the principle of least privilege.
- Review the IAM policies and make any necessary updates to align with your security requirements.
- In the Keyspace details page, click on the
Review Network Security
- In the Keyspace details page, click on the
Configurationtab. - Under the
Network & Securitysection, review the VPC, subnets, security groups, and network ACLs associated with the Keyspace. - Ensure that the VPC and subnet configurations align with your security requirements.
- Review the security group rules and network ACL rules to ensure they restrict access to necessary ports, IP ranges, and protocols.
- Make any necessary updates to tighten the network security settings.
- In the Keyspace details page, click on the
Review Encryption Settings
- In the Keyspace details page, click on the
Configurationtab. - Under the
Encryptionsection, review the encryption settings for the Keyspace. - Ensure that encryption at rest and in transit are enabled and the appropriate encryption options are chosen.
- Review any customer-managed keys used for encryption and verify their configurations.
- In the Keyspace details page, click on the
Review Access Control
- In the Keyspace details page, click on the
Configurationtab. - Under the
Authentication and access controlsection, review the Access Control Lists (ACLs) for the Keyspace. - Ensure the ACLs define appropriate access permissions at the table and row levels.
- Review the ACL rules and make any necessary updates to align with your security policies and access requirements.
- In the Keyspace details page, click on the
Review Audit Logging
- In the Keyspace details page, click on the
Configurationtab. - Review the Keyspace's logging configuration under the
Loggingsection. - Ensure the logs are captured and stored in CloudWatch Logs as expected.
- Please review the log retention settings and y that they comply with your retention policies.
- In the Keyspace details page, click on the
Regularly Monitor Security Bulletins
- Stay updated with AWS security bulletins, advisories, and best practices.
- Monitor AWS security announcements and subscribe to relevant security notifications.
- Regularly review and apply security patches, updates, and recommended configuration changes for Amazon Keyspaces.
Expected Result
All security configurations for Keyspaces (IAM, network, encryption, access control, audit logging) are regularly reviewed and updated to align with security requirements.
Remediation
Using AWS Console
Follow the same steps as the audit procedure to review and update security configurations for Amazon Keyspaces on a regular schedule.
Default Value
N/A - This is a procedural control that requires regular manual review.
References
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 5 Account Management | |||
| v7 | 5 Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations and Servers |
Profile
Level 1 | Manual